CVE-2026-8194: osTicket Dispatcher class.dispatcher.php cross-site request forgery
A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argument method leads to cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
osTicket Dispatcher class.dispatcher.phpto a version that resolves this vulnerability.Fixed in 1.18.3 - Configuration
Update osTicket Dispatcher code in include/class.dispatcher.php so the _method argument cannot be manipulated by the client (e.g., do not accept user-controlled _method for action routing; use server-side routing only).
osTicket Dispatcher (class.dispatcher.php) _method parameter handling = Remove/ignore user-controlled _method input to prevent CSRF via method manipulation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8194?
CVE-2026-8194 has been classified as a moderate severity vulnerability due to its potential impact on application security through cross-site request forgery.
How do I fix CVE-2026-8194?
To fix CVE-2026-8194, upgrade osTicket to the latest version beyond 1.18.3, where this vulnerability has been addressed.
Is my version of osTicket affected by CVE-2026-8194?
If you are using osTicket version 1.18.3 or earlier, your version is affected by CVE-2026-8194.
What type of vulnerability is CVE-2026-8194?
CVE-2026-8194 is classified as a cross-site request forgery (CSRF) vulnerability affecting the dispatcher component of osTicket.
What components of osTicket does CVE-2026-8194 impact?
CVE-2026-8194 specifically impacts the include/class.dispatcher.php file in the Dispatcher component of osTicket.